Firewall logging of all connection

[S891]

Hi,

Is there a way to log all sessions details (source, dest , protocol, port, time) regardless of successful or denied connections. I know the "log" keyword in ACL will enable logging for a particular ACL but I am wondering if there is a global method if you want to log all connection details to a Syslog server? 

[Aditya Ganjoo]

Hi,

Yes you can do it.

logging trap debugging--- This command would send all the logs to the syslog server

Regards,

Aditya

Please rate helpful and mark correct answers

[S891]

We already have it enabled. But it does not record full detail. 

For example: 

Aug 15 2017 14:48:31 FW-PRI : %ASA-7-609001: Built local-host OUTSIDE:62.220.165.177

This is only recording Outside IP address but no information recorded for the Inside host. 

[Mohammad Alhyari]

Look for those messages:

%ASA-6-302013: Built outbound TCP connection 9 for outside:10.1.2.1/22 (10.1.2.1/22) 
to inside:10.1.1.2/53496 (10.1.1.2/53496)

%ASA-6-302014: Teardown TCP connection 9 for outside:10.1.2.1/22 to inside:
10.1.1.2/53496 duration 0:00:30 bytes 0 SYN Timeout

%ASA-6-302013: Built inbound TCP connection 8 for 
inside:10.1.1.2/12523 (10.1.1.2/12523) to NP Identity
Ifc:10.1.1.1/22 (10.1.1.1/22)

%ASA-6-302014: Teardown TCP connection 8 for inside:
10.1.1.2/12523 to NP Identity Ifc:10.1.1.1/22 duration
0:00:53 bytes 2436 TCP FINs

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/116149-qanda-ASA-00.html

Moh,